CVE-2026-110252
Received Received - Intake

Stored XSS in WPeMatico RSS Feed Fetcher WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign's last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item->get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-110252
EUVD
EUVD-2026-102798

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
etruel WPeMatico RSS Feed Fetcher 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the WPeMatico RSS Feed Fetcher WordPress plugin up to version 2.9. It occurs because the plugin removes WordPress's wp_filter_post_kses filter before saving RSS feed content, allowing unauthenticated attackers to inject malicious scripts via compromised or malicious RSS feeds. These scripts execute when users access infected posts.

Detection Guidance

Check if you are running WPeMatico RSS Feed Fetcher plugin version 2.9 or lower. Inspect WordPress admin campaigns for unexpected scripts in imported posts. Review server logs for unusual activity linked to RSS feed processing.

Impact Analysis

If exploited, this vulnerability allows attackers to inject arbitrary web scripts into WordPress posts. This could lead to unauthorized actions on behalf of users, data theft, or defacement of websites. Users visiting infected pages may have their sessions hijacked or sensitive information compromised.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA compliance requirements. Unauthorized script execution may expose user data, triggering legal penalties, fines, or reputational damage due to non-compliance with data protection regulations.

Mitigation Strategies

Update the WPeMatico plugin to version 2.9.1 or higher immediately. Disable the plugin temporarily if an update is not available. Review and sanitize existing imported posts for malicious scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-110252. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart